Do not save HBAC rules in subdomain subtree

Currently the sysdb context is pointed to the subdomain subtree
containing user the user to be checked at the beginning of a HBAC
request. As a result all HBAC rules and related data is save in the
subdomain tree as well. But since the HBAC rules of the configured
domain apply to all users it is sufficient to save them once in the
subtree of the configured domain.

Since most of the sysdb operations during a HBAC request are related to
the HBAC rules and related data this patch does not change the default
sysdb context but only create a special context to look up subdomain
users.

1 files changed, 16 insertions, 3 deletions

diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c
index 54628d80b..33d1944ee 100644
--- a/src/providers/ipa/ipa_hbac_common.c
+++ b/src/providers/ipa/ipa_hbac_common.c
@@ -440,6 +440,7 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
     struct sss_domain_info *domain = hbac_ctx_be(hbac_ctx)->domain;
     const char *rhost;
     const char *thost;
+    struct sss_domain_info *user_dom;
 
     tmp_ctx = talloc_new(mem_ctx);
     if (tmp_ctx == NULL) return ENOMEM;
@@ -452,9 +453,21 @@ hbac_ctx_to_eval_request(TALLOC_CTX *mem_ctx,
 
     eval_req->request_time = time(NULL);
 
-    /* Get user the user name and groups */
-    ret = hbac_eval_user_element(eval_req, sysdb,
-                                 pd->user, &eval_req->user);
+    /* Get user the user name and groups,
+     * take care of subdomain users as well */
+    if (strcasecmp(pd->domain, domain->name) != 0) {
+        user_dom = new_subdomain(tmp_ctx, domain, pd->domain, NULL, NULL);
+        if (user_dom == NULL) {
+            DEBUG(SSSDBG_OP_FAILURE, ("new_subdomain failed.\n"));
+            ret = ENOMEM;
+            goto done;
+        }
+        ret = hbac_eval_user_element(eval_req, user_dom->sysdb,
+                                     pd->user, &eval_req->user);
+    } else {
+        ret = hbac_eval_user_element(eval_req, sysdb,
+                                     pd->user, &eval_req->user);
+    }
     if (ret != EOK) goto done;
 
     /* Get the PAM service and service groups */